d8ddcaf9cd45a56b85f95438c3345360389de485aafb78d27794b6a2c88a31f2

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8ddcaf9cd45a56b85f95438c3345360389de485aafb78d27794b6a2c88a31f2.exe
Size

188KB
MD5

cd01fa539c9bf1b89c53d2c624e05e66
SHA1

31e61ff4266a7371b1b22386ab1c1a3c949e2ea1
SHA256

d8ddcaf9cd45a56b85f95438c3345360389de485aafb78d27794b6a2c88a31f2
SHA512

1e01beca4f61945f112ea71bbca41dd15675e7502f240f6c459c393cedba7c5be5b9d5fed8f5cefc06fd843b34bec0e27a5071b83921fe24eed56f8e95cf0453
SSDEEP

3072:mtuBiI9bHavq1OKCRhmHvsRNltx1AerDtsr3vhqhEN4MAH+mbPepZBC8qzNJSKrX:tBzHay1OKCrmPex1AelhEN4MujGJoSoX

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjaqpbkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeddnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifomll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhkbdmbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ockdmmoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbighjdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahaceo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qoifflkg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egaejeej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkadfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdilnojp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gacepg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkdliame.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Leopnglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fnnjmbpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kheekkjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flnlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgndoeag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chfegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekjded32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjhacf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jenmcggo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljqhkckn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lchfib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppjgoaoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgdokkfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pofjpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejdocm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgoeep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhgonidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbbpmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpeiioac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Molelb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oekiqccc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ooagno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjlgdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpode32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbdehlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hehkajig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgloefco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocgbld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kplpjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Injmcmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Igchfiof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnipbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eqdpgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khiofk32.exe

Executes dropped EXE 64 IoCs

pid	Process
4780	Dohfbj32.exe
4428	Dddojq32.exe
2528	Dojcgi32.exe
840	Eaklidoi.exe
2252	Eamhodmf.exe
3464	Edkdkplj.exe
3668	Ecmeig32.exe
4388	Ekhjmiad.exe
4540	Ehljfnpn.exe
836	Ecandfpd.exe
1288	Ehnglm32.exe
1072	Faihkbci.exe
4080	Flnlhk32.exe
2780	Fchddejl.exe
1604	Flqimk32.exe
1808	Ffimfqgm.exe
3628	Foabofnn.exe
3632	Gcojed32.exe
2256	Glhonj32.exe
1720	Gfpcgpae.exe
2384	Gkmlofol.exe
2884	Gfbploob.exe
4316	Gkoiefmj.exe
1728	Gcfqfc32.exe
1568	Gfgjgo32.exe
2456	Hihbijhn.exe
3772	Hobkfd32.exe
1844	Hkikkeeo.exe
4964	Heapdjlp.exe
1820	Hofdacke.exe
4664	Hmjdjgjo.exe
1460	Iefioj32.exe
4012	Ibjjhn32.exe
3740	Iehfdi32.exe
1352	Ipnjab32.exe
4444	Ifgbnlmj.exe
1000	Imakkfdg.exe
756	Ibnccmbo.exe
2052	Iihkpg32.exe
2304	Ipbdmaah.exe
4068	Ieolehop.exe
3696	Icplcpgo.exe
2848	Jeaikh32.exe
2008	Jlkagbej.exe
3656	Jfaedkdp.exe
464	Jlnnmb32.exe
1688	Jcgbco32.exe
4336	Jfeopj32.exe
1260	Jlbgha32.exe
2140	Jcioiood.exe
3728	Jeklag32.exe
2348	Jcllonma.exe
3836	Kmdqgd32.exe
3964	Kbaipkbi.exe
2400	Kmfmmcbo.exe
1676	Kpeiioac.exe
1552	Kfoafi32.exe
1940	Kpgfooop.exe
3828	Kbfbkj32.exe
3108	Kipkhdeq.exe
1592	Kpjcdn32.exe
4600	Kibgmdcn.exe
1852	Kplpjn32.exe
2316	Liddbc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mipcob32.exe	Mgagbf32.exe
File created	C:\Windows\SysWOW64\Hgjbkhen.dll	Hofmfmhj.exe
File created	C:\Windows\SysWOW64\Nohehq32.exe	Nlihle32.exe
File opened for modification	C:\Windows\SysWOW64\Ooagno32.exe	Ohgoaehe.exe
File created	C:\Windows\SysWOW64\Hhknpmma.exe	Hpdfnolo.exe
File opened for modification	C:\Windows\SysWOW64\Miofjepg.exe	Mbbagk32.exe
File created	C:\Windows\SysWOW64\Nondlbmd.dll	Blhpqhlh.exe
File created	C:\Windows\SysWOW64\Flakaffp.dll	Fmkgkapm.exe
File created	C:\Windows\SysWOW64\Idahjg32.exe	Iljpij32.exe
File opened for modification	C:\Windows\SysWOW64\Pflibgil.exe	Pcmlfl32.exe
File created	C:\Windows\SysWOW64\Nbefdijg.exe	Nknobkje.exe
File opened for modification	C:\Windows\SysWOW64\Glldgljg.exe	Gfokoelp.exe
File opened for modification	C:\Windows\SysWOW64\Meepdp32.exe	Mmnhcb32.exe
File opened for modification	C:\Windows\SysWOW64\Hofdacke.exe	Heapdjlp.exe
File opened for modification	C:\Windows\SysWOW64\Eecdjmfi.exe	Dknpmdfc.exe
File opened for modification	C:\Windows\SysWOW64\Phbhcmjl.exe	Ooejohhq.exe
File opened for modification	C:\Windows\SysWOW64\Akcjkfij.exe	Ahcajk32.exe
File created	C:\Windows\SysWOW64\Dpipfd32.dll	Dimenegi.exe
File created	C:\Windows\SysWOW64\Cnahdi32.exe	Ckclhn32.exe
File opened for modification	C:\Windows\SysWOW64\Ncnofeof.exe	Nqpcjj32.exe
File opened for modification	C:\Windows\SysWOW64\Geldkfpi.exe	Gaqhjggp.exe
File created	C:\Windows\SysWOW64\Ecandfpd.exe	Ehljfnpn.exe
File created	C:\Windows\SysWOW64\Ladjgikj.dll	Ogkcpbam.exe
File opened for modification	C:\Windows\SysWOW64\Oneklm32.exe	Ogkcpbam.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Anadoi32.exe
File opened for modification	C:\Windows\SysWOW64\Foghnabl.exe	Fgppmd32.exe
File created	C:\Windows\SysWOW64\Moqeaphi.dll	Ehhpla32.exe
File created	C:\Windows\SysWOW64\Diccgfpd.exe	Dfefkkqp.exe
File created	C:\Windows\SysWOW64\Fligqhga.exe	Feoodn32.exe
File opened for modification	C:\Windows\SysWOW64\Gppcmeem.exe	Gmafajfi.exe
File created	C:\Windows\SysWOW64\Dnbjkgmg.dll	Jpcapp32.exe
File created	C:\Windows\SysWOW64\Kqkplq32.dll	Obqanjdb.exe
File created	C:\Windows\SysWOW64\Lhclbphg.dll	Flqimk32.exe
File created	C:\Windows\SysWOW64\Jfenmm32.dll	Mmpijp32.exe
File opened for modification	C:\Windows\SysWOW64\Npjebj32.exe	Ncfdie32.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Pgbbek32.exe	Ookjdn32.exe
File created	C:\Windows\SysWOW64\Pflibgil.exe	Pcmlfl32.exe
File opened for modification	C:\Windows\SysWOW64\Jleijb32.exe	Jiglnf32.exe
File created	C:\Windows\SysWOW64\Eoekia32.exe	Ehkclgmb.exe
File created	C:\Windows\SysWOW64\Jeggngeb.dll	Ehfcfb32.exe
File created	C:\Windows\SysWOW64\Fnpeoe32.dll	Bckkca32.exe
File opened for modification	C:\Windows\SysWOW64\Gbnoiqdq.exe	Gppcmeem.exe
File created	C:\Windows\SysWOW64\Jmeede32.exe	Jenmcggo.exe
File created	C:\Windows\SysWOW64\Fmggcl32.dll	Kpjgaoqm.exe
File opened for modification	C:\Windows\SysWOW64\Ckbemgcp.exe	Bhblllfo.exe
File created	C:\Windows\SysWOW64\Lojmcdgl.exe	Lebijnak.exe
File opened for modification	C:\Windows\SysWOW64\Gcojed32.exe	Foabofnn.exe
File created	C:\Windows\SysWOW64\Fddanicf.dll	Ghpendjj.exe
File created	C:\Windows\SysWOW64\Jblpmmae.dll	Nedjjj32.exe
File created	C:\Windows\SysWOW64\Imllmfjk.dll	Oghppm32.exe
File created	C:\Windows\SysWOW64\Ehfcfb32.exe	Epokedmj.exe
File opened for modification	C:\Windows\SysWOW64\Cfqmpl32.exe	Ccbadp32.exe
File created	C:\Windows\SysWOW64\Ncliqp32.dll	Emmkiclm.exe
File created	C:\Windows\SysWOW64\Apoigbgj.dll	Injmcmej.exe
File created	C:\Windows\SysWOW64\Mlkpophj.dll	Hlglidlo.exe
File created	C:\Windows\SysWOW64\Qgnnai32.dll	Mgphpe32.exe
File opened for modification	C:\Windows\SysWOW64\Fbdehlip.exe	Fniihmpf.exe
File created	C:\Windows\SysWOW64\Hbenoi32.exe	Hpfbcn32.exe
File created	C:\Windows\SysWOW64\Lpnlpnih.exe	Liddbc32.exe
File created	C:\Windows\SysWOW64\Bbbmaq32.dll	Ehdmlhcj.exe
File created	C:\Windows\SysWOW64\Gfajam32.dll	Gkglja32.exe
File created	C:\Windows\SysWOW64\Mgekdpbp.dll	Niakfbpa.exe
File created	C:\Windows\SysWOW64\Impliekg.exe	Ieidhh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11164	9928	WerFault.exe	1025

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Choehhlk.dll"	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diinlj32.dll"	Cnahdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jenmcggo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jebfng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbfbkj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Majjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dbcmakpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eiieicml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iipejo32.dll"	Cabomkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiejjepo.dll"	Hpnoncim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhmbqm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llipehgk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ollnhb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fmjaphek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ejlbhh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kekbjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oflgep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dlieda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaiann32.dll"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emlenj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenqhaga.dll"	Emkndc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hbhboolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kabcopmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blfiei32.dll"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ephccnmj.dll"	Bjpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efeifngp.dll"	Eifhdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jnlbojee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fofdocoe.dll"	Dkhnjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gndick32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljgmjm32.dll"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfnegggi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jklaah32.dll"	Iahlcaol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kjhcjq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Niakfbpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjdejk32.dll"	Hpofii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eofgpikj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qfbobf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jgbchj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knefeffd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liokmchg.dll"	Edhjqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkpheidp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eifhdd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anclbkbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aijqqd32.dll"	Hlpfhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kcpjnjii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffggf32.dll"	Cjmgfgdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nohehq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjliajmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kamhmbej.dll"	Dlieda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oncelonn.dll"	Egaejeej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgmbieme.dll"	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najmlf32.dll"	Nggjdc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agjhgngj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkgohbq.dll"	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ccgjopal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifmqfm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4780	5028	d8ddcaf9cd45a56b85f95438c3345360389de485aafb78d27794b6a2c88a31f2.exe	88
PID 5028 wrote to memory of 4780	5028	d8ddcaf9cd45a56b85f95438c3345360389de485aafb78d27794b6a2c88a31f2.exe	88
PID 5028 wrote to memory of 4780	5028	d8ddcaf9cd45a56b85f95438c3345360389de485aafb78d27794b6a2c88a31f2.exe	88
PID 4780 wrote to memory of 4428	4780	Dohfbj32.exe	89
PID 4780 wrote to memory of 4428	4780	Dohfbj32.exe	89
PID 4780 wrote to memory of 4428	4780	Dohfbj32.exe	89
PID 4428 wrote to memory of 2528	4428	Dddojq32.exe	90
PID 4428 wrote to memory of 2528	4428	Dddojq32.exe	90
PID 4428 wrote to memory of 2528	4428	Dddojq32.exe	90
PID 2528 wrote to memory of 840	2528	Dojcgi32.exe	91
PID 2528 wrote to memory of 840	2528	Dojcgi32.exe	91
PID 2528 wrote to memory of 840	2528	Dojcgi32.exe	91
PID 840 wrote to memory of 2252	840	Eaklidoi.exe	92
PID 840 wrote to memory of 2252	840	Eaklidoi.exe	92
PID 840 wrote to memory of 2252	840	Eaklidoi.exe	92
PID 2252 wrote to memory of 3464	2252	Eamhodmf.exe	93
PID 2252 wrote to memory of 3464	2252	Eamhodmf.exe	93
PID 2252 wrote to memory of 3464	2252	Eamhodmf.exe	93
PID 3464 wrote to memory of 3668	3464	Edkdkplj.exe	94
PID 3464 wrote to memory of 3668	3464	Edkdkplj.exe	94
PID 3464 wrote to memory of 3668	3464	Edkdkplj.exe	94
PID 3668 wrote to memory of 4388	3668	Ecmeig32.exe	96
PID 3668 wrote to memory of 4388	3668	Ecmeig32.exe	96
PID 3668 wrote to memory of 4388	3668	Ecmeig32.exe	96
PID 4388 wrote to memory of 4540	4388	Ekhjmiad.exe	97
PID 4388 wrote to memory of 4540	4388	Ekhjmiad.exe	97
PID 4388 wrote to memory of 4540	4388	Ekhjmiad.exe	97
PID 4540 wrote to memory of 836	4540	Ehljfnpn.exe	98
PID 4540 wrote to memory of 836	4540	Ehljfnpn.exe	98
PID 4540 wrote to memory of 836	4540	Ehljfnpn.exe	98
PID 836 wrote to memory of 1288	836	Ecandfpd.exe	99
PID 836 wrote to memory of 1288	836	Ecandfpd.exe	99
PID 836 wrote to memory of 1288	836	Ecandfpd.exe	99
PID 1288 wrote to memory of 1072	1288	Ehnglm32.exe	100
PID 1288 wrote to memory of 1072	1288	Ehnglm32.exe	100
PID 1288 wrote to memory of 1072	1288	Ehnglm32.exe	100
PID 1072 wrote to memory of 4080	1072	Faihkbci.exe	102
PID 1072 wrote to memory of 4080	1072	Faihkbci.exe	102
PID 1072 wrote to memory of 4080	1072	Faihkbci.exe	102
PID 4080 wrote to memory of 2780	4080	Flnlhk32.exe	103
PID 4080 wrote to memory of 2780	4080	Flnlhk32.exe	103
PID 4080 wrote to memory of 2780	4080	Flnlhk32.exe	103
PID 2780 wrote to memory of 1604	2780	Fchddejl.exe	104
PID 2780 wrote to memory of 1604	2780	Fchddejl.exe	104
PID 2780 wrote to memory of 1604	2780	Fchddejl.exe	104
PID 1604 wrote to memory of 1808	1604	Flqimk32.exe	105
PID 1604 wrote to memory of 1808	1604	Flqimk32.exe	105
PID 1604 wrote to memory of 1808	1604	Flqimk32.exe	105
PID 1808 wrote to memory of 3628	1808	Ffimfqgm.exe	106
PID 1808 wrote to memory of 3628	1808	Ffimfqgm.exe	106
PID 1808 wrote to memory of 3628	1808	Ffimfqgm.exe	106
PID 3628 wrote to memory of 3632	3628	Foabofnn.exe	107
PID 3628 wrote to memory of 3632	3628	Foabofnn.exe	107
PID 3628 wrote to memory of 3632	3628	Foabofnn.exe	107
PID 3632 wrote to memory of 2256	3632	Gcojed32.exe	109
PID 3632 wrote to memory of 2256	3632	Gcojed32.exe	109
PID 3632 wrote to memory of 2256	3632	Gcojed32.exe	109
PID 2256 wrote to memory of 1720	2256	Glhonj32.exe	110
PID 2256 wrote to memory of 1720	2256	Glhonj32.exe	110
PID 2256 wrote to memory of 1720	2256	Glhonj32.exe	110
PID 1720 wrote to memory of 2384	1720	Gfpcgpae.exe	111
PID 1720 wrote to memory of 2384	1720	Gfpcgpae.exe	111
PID 1720 wrote to memory of 2384	1720	Gfpcgpae.exe	111
PID 2384 wrote to memory of 2884	2384	Gkmlofol.exe	112

C:\Users\Admin\AppData\Local\Temp\d8ddcaf9cd45a56b85f95438c3345360389de485aafb78d27794b6a2c88a31f2.exe
"C:\Users\Admin\AppData\Local\Temp\d8ddcaf9cd45a56b85f95438c3345360389de485aafb78d27794b6a2c88a31f2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\Dohfbj32.exe
  C:\Windows\system32\Dohfbj32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\Dddojq32.exe
    C:\Windows\system32\Dddojq32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\SysWOW64\Dojcgi32.exe
      C:\Windows\system32\Dojcgi32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:840
      - C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        23⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        24⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        25⤵
        Executes dropped EXE
        
        PID:1728
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        26⤵
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        27⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        28⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        29⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4964
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1820
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        32⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        33⤵
        Executes dropped EXE
        
        PID:1460
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        34⤵
        Executes dropped EXE
        
        PID:4012
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        35⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        36⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        37⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        38⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        39⤵
        Executes dropped EXE
        
        PID:756
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        40⤵
        Executes dropped EXE
        
        PID:2052
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        41⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        42⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        43⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        44⤵
        Executes dropped EXE
        
        PID:2848
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        45⤵
        Executes dropped EXE
        
        PID:2008
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        46⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        47⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        48⤵
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        49⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        50⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        51⤵
        Executes dropped EXE
        
        PID:2140
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        52⤵
        Executes dropped EXE
        
        PID:3728
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        53⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3836
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        55⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        56⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1676
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        58⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        59⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3828
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        61⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        62⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        63⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2316
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        66⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        67⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        68⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        69⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        70⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        71⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        72⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        73⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        74⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        75⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        76⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        77⤵
        Drops file in System32 directory
        
        PID:4140
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        78⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        79⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        80⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        81⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        82⤵
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        84⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        85⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        87⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        88⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        89⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        90⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        91⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        92⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        93⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        94⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5780
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        96⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        97⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        98⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        99⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        100⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        101⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        102⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        103⤵
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        104⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        105⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        106⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        107⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        108⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        109⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        111⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5744
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        113⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        114⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        115⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        116⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        117⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        118⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        119⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        120⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        121⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        123⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        125⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        126⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        127⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        128⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        129⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        130⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        131⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        132⤵
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        133⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        134⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        135⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        136⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        137⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        138⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        139⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        141⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        142⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6220
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        144⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        145⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        146⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6400
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        148⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        149⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        150⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        151⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        152⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        153⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        154⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        156⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        157⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        158⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        159⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        160⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        161⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        162⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        163⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        164⤵
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        165⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        166⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        168⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        169⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        170⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        171⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        172⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        173⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        174⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        175⤵
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        177⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        178⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7076
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        180⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        181⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        182⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        183⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        184⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        185⤵
        Drops file in System32 directory
        
        PID:6684
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        186⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        187⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        188⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Ehkclgmb.exe
        
        C:\Windows\system32\Ehkclgmb.exe
        189⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        190⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        191⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        193⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Fhpmgg32.exe
        
        C:\Windows\system32\Fhpmgg32.exe
        194⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        195⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        196⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        197⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        198⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        199⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        200⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        201⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        202⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        203⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        204⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        205⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        206⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        207⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        208⤵
        Drops file in System32 directory
        
        PID:7396
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        209⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Gdgfce32.exe
        
        C:\Windows\system32\Gdgfce32.exe
        210⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        211⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Hnoklk32.exe
        
        C:\Windows\system32\Hnoklk32.exe
        212⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        213⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        214⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        215⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        216⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        217⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        218⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        219⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7948
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        221⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        222⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        223⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        224⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        225⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        226⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        227⤵
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        228⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        229⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        230⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        231⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        232⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        233⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        234⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        235⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        236⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        237⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        238⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        239⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Lemkcnaa.exe
        
        C:\Windows\system32\Lemkcnaa.exe
        240⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        241⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        242⤵
        Modifies registry class
        
        PID:8188
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        243⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        244⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        245⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        247⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        248⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        249⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        250⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        251⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        252⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        253⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        254⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        255⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        257⤵
        Modifies registry class
        
        PID:7620
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        258⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        259⤵
        Drops file in System32 directory
        
        PID:7912
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        260⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        261⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        262⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        263⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        264⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        265⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7332
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        267⤵
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        268⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        269⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        270⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        271⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        272⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        273⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        274⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        275⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        276⤵
        Modifies registry class
        
        PID:8392
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        277⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        278⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        279⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8560
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        282⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        283⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        284⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        285⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        286⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        287⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        288⤵
        Drops file in System32 directory
        
        PID:8896
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        289⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        290⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        291⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        292⤵
        Modifies registry class
        
        PID:9060
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        293⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9144
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        295⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        296⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8264
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        298⤵
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        299⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        300⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        301⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        302⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        303⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        304⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        305⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        306⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        307⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        308⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        309⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        310⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        311⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        312⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8476
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        314⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        315⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8848
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        317⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        318⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        319⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        320⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        321⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        322⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        323⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        324⤵
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        325⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        326⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        327⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8968
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        329⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        330⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        331⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        332⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        333⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        334⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        335⤵
        
        PID:512
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        336⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        337⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        338⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        339⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        340⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        341⤵
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        342⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        343⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        344⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        345⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        346⤵
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        347⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        348⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        349⤵
        Drops file in System32 directory
        
        PID:9660
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        350⤵
        Drops file in System32 directory
        
        PID:9704
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9740
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        352⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        353⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        354⤵
        Drops file in System32 directory
        
        PID:9884
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        355⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        356⤵
        Modifies registry class
        
        PID:9972
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        357⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        358⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Fipbdikp.exe
        
        C:\Windows\system32\Fipbdikp.exe
        359⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        360⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        361⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        362⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        363⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        364⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        365⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        366⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        367⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        368⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        369⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        370⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        371⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        372⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        373⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        374⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        375⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        376⤵
        Modifies registry class
        
        PID:9448
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        377⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9756
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        379⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        380⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        381⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        382⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        383⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        384⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        385⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        386⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        387⤵
        Drops file in System32 directory
        
        PID:9800
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        388⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        389⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        390⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        391⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        392⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        393⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10496
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        395⤵
        Modifies registry class
        
        PID:10544
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        396⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        397⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        398⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        399⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        400⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        401⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        402⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        403⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        404⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        405⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        406⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        407⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        408⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        409⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        410⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        411⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        412⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        413⤵
        Modifies registry class
        
        PID:10364
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        414⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        415⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        416⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        417⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10708
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        419⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        420⤵
        Drops file in System32 directory
        
        PID:10896
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        421⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        422⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        423⤵
        Modifies registry class
        
        PID:11132
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        424⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        425⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        426⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10404
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        427⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        428⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        429⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        430⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        431⤵
        Drops file in System32 directory
        
        PID:10968
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        432⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        433⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        434⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9320
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        435⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        436⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10676
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        438⤵
        Drops file in System32 directory
        
        PID:10812
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        439⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        440⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        441⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        442⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11016
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        444⤵
        Drops file in System32 directory
        
        PID:9532
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        445⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        446⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        447⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        448⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        449⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        450⤵
        Drops file in System32 directory
        
        PID:11336
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        451⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        452⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        453⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        454⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        455⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        456⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        457⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        458⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        459⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        460⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        461⤵
        Modifies registry class
        
        PID:11876
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        462⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        463⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        464⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        465⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        466⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        467⤵
        Drops file in System32 directory
        
        PID:12144
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        468⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        469⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        470⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        471⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        472⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        473⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        474⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        475⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        476⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        477⤵
        Drops file in System32 directory
        
        PID:11852
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        478⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        479⤵
        Modifies registry class
        
        PID:12000
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        480⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        481⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        482⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        483⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        484⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        485⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        486⤵
        Modifies registry class
        
        PID:11704
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        487⤵
        Drops file in System32 directory
        
        PID:11836
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        488⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        489⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12176
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        491⤵
        Modifies registry class
        
        PID:11312
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        492⤵
        Modifies registry class
        
        PID:11484
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        493⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        494⤵
        Drops file in System32 directory
        
        PID:11912
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        495⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        496⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        497⤵
        Modifies registry class
        
        PID:11520
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        498⤵
        Modifies registry class
        
        PID:11856
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        499⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        500⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        501⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        502⤵
        Drops file in System32 directory
        
        PID:11448
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        503⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        504⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        505⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        506⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        507⤵
        Modifies registry class
        
        PID:4052
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        508⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        509⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        510⤵
        Modifies registry class
        
        PID:3396
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        511⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        512⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        513⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12412
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        514⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        515⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        516⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        517⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        518⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        519⤵
        Drops file in System32 directory
        
        PID:12696
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        520⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        521⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        522⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        523⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        524⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        525⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        526⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        527⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        528⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        529⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        530⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        531⤵
        Drops file in System32 directory
        
        PID:13260
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        532⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        533⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        534⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        535⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        536⤵
        Modifies registry class
        
        PID:12492
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        537⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        538⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        539⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        540⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        541⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        542⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        543⤵
        
        PID:12904
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        544⤵
        Drops file in System32 directory
        
        PID:1840
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        545⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        546⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        547⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2064
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        548⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        549⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        550⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        551⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        552⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        553⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        554⤵
        
        PID:12420
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        555⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        556⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        557⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        558⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        559⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        560⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        561⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        562⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        563⤵
        Modifies registry class
        
        PID:13016
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        564⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        565⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        566⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        567⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        568⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        569⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        570⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        571⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        572⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        573⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        574⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        575⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        576⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        577⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        578⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        579⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        580⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        581⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        582⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        583⤵
        
        PID:536
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        584⤵
        Drops file in System32 directory
        
        PID:3120
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        585⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        586⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3796
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        588⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        589⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        590⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        591⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        592⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        593⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        594⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        595⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        596⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        597⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        598⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        599⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        600⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        601⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        602⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        603⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        604⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        605⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        606⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        607⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        608⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        609⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        610⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        611⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        612⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        613⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        614⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        615⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        616⤵
        Modifies registry class
        
        PID:1676
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        617⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        618⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        619⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        620⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        621⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        622⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        623⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        624⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        625⤵
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        626⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        627⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        628⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        629⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        630⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        631⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        632⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        633⤵
        Modifies registry class
        
        PID:2620
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        634⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        635⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        636⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        637⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        638⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        639⤵
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        640⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        641⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        642⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        643⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        644⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        645⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        646⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        647⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        648⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        649⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        650⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        651⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        652⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        653⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        654⤵
        Drops file in System32 directory
        
        PID:4172
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        655⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        656⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        657⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        658⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5924
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        659⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        660⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        661⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        662⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6056
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        663⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        664⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        665⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        666⤵
        Drops file in System32 directory
        
        PID:11632
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        667⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        668⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        669⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        670⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        671⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        672⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        673⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        674⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        675⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        676⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        677⤵
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        678⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        679⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        680⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        681⤵
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        682⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        683⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        684⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        685⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        686⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        687⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        688⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        689⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        690⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        691⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        692⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        693⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        694⤵
        Drops file in System32 directory
        
        PID:5500
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        695⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        696⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        697⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        698⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        699⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        700⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        701⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        702⤵
        Drops file in System32 directory
        
        PID:13240
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        703⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        704⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        705⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        706⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        707⤵
        Modifies registry class
        
        PID:7456
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        708⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        709⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        710⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        711⤵
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        712⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5612
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        713⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        714⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        715⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        716⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        717⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        718⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        719⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        720⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        721⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        722⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        723⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        724⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        725⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        726⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        727⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        728⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        729⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        730⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        731⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5148
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        732⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        733⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        734⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        735⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        736⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        737⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        738⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        739⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        740⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        741⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8092
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        742⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        743⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        744⤵
        Drops file in System32 directory
        
        PID:5072
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        745⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        746⤵
        
        PID:968
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        747⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        748⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        749⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        750⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        751⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        752⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        753⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        754⤵
        Drops file in System32 directory
        
        PID:8116
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        755⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        756⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        757⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        758⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        759⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        760⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        761⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5552
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        762⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        763⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        764⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        765⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        766⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        767⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        768⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        769⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        770⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        771⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        772⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        773⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        774⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        775⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        776⤵
        Modifies registry class
        
        PID:6360
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        777⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        778⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        779⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:912
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        780⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        781⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        782⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        783⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        784⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        785⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        786⤵
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        787⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        788⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6332
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        789⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        790⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        791⤵
        Drops file in System32 directory
        
        PID:8412
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        792⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        793⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        794⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        795⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8700
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        796⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        797⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        798⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        799⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        800⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        801⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        802⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        803⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        804⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        805⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        806⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        807⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        808⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        809⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        810⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9012
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        811⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        812⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        813⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        814⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        815⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        816⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:532
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        817⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6568
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        818⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        819⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        820⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        821⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        822⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        823⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        824⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        825⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        826⤵
        Drops file in System32 directory
        
        PID:6592
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        827⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5060
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        828⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        829⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        830⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        831⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        832⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        833⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        834⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Gaqhjggp.exe
        
        C:\Windows\system32\Gaqhjggp.exe
        835⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        836⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        837⤵
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        838⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9112
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        839⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        840⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        841⤵
        Drops file in System32 directory
        
        PID:8272
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        842⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        843⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        844⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        845⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        846⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        847⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        848⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        849⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        850⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        851⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        852⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        853⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        854⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        855⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9304
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        856⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        857⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        858⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        859⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        860⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        861⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        862⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        863⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8308
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        864⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        865⤵
        Modifies registry class
        
        PID:8156
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        866⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9976
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        867⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        868⤵
        Modifies registry class
        
        PID:9188
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        869⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        870⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        871⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        872⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        873⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        874⤵
        Drops file in System32 directory
        
        PID:9032
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        875⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        876⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        877⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        878⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        879⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7976
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        880⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        881⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        882⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        883⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        884⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        885⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        886⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        887⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        888⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        889⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        890⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        891⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        892⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        893⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        894⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        895⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        896⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        897⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        898⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        899⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        900⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        901⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        902⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        903⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        904⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        905⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        906⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        907⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        908⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        909⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        910⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        911⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8688
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        912⤵
        Modifies registry class
        
        PID:8788
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        913⤵
        Drops file in System32 directory
        
        PID:4000
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        914⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        915⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        916⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        917⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        918⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        919⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        920⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        921⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        922⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        923⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        924⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        925⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9928 -s 420
        926⤵
        Program crash
        
        PID:11164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 9928 -ip 9928
1⤵
PID:10220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aepefb32.exe

Filesize
188KB

MD5
222ecc18181a9766f89d265fe3d90fd5

SHA1
057938fafff1e369f6abcc323d706d2babb9cb68

SHA256
3d803b144b95fac4628e54ec48bb053f66cb392f9f43269018f498e4688b0d89

SHA512
6d0f52b63cb5ca6c1f2663008552a07ccb77c663356ad172c561d8228e9d67a577177d31702ea13302c6ac997f31e75b093110aa21787560fb108edc5f7e2c0c

Download Submit
C:\Windows\SysWOW64\Ahcajk32.exe

Filesize
188KB

MD5
97b0b08620637d65dc7a4451f368e962

SHA1
9822051a98750cb784f596c432e40bb458dfab55

SHA256
2846d9a342ebc50c9c98c83b18388090f284a0981d1fb46dfa203885143b70c5

SHA512
eeb1ade421822c1fda8b7ba494febb8ac6b3ce7cced23e58e9c35ad39281d6612ae1230792f3c26ea5b5ef565f3f2bd4a0727de7512bb6af6665791f8b2df3f4

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
188KB

MD5
ae6adaa65772747858b15e7f702a2244

SHA1
6c8c26749a026e1481878a1f33cd86269c41dae4

SHA256
c941185097ed1d4a7179b519905875700106b37598aef8b19a966ed3a40a3e8e

SHA512
764d3ad049ec902f36b52133394fc9ad570365735997aa9e8694c5f3d7058ae4ffd2c7a8a2a8d10c6322e80ae386ef3afc3f89d124f266963bcc16b4d61875f7

Download Submit
C:\Windows\SysWOW64\Dddojq32.exe

Filesize
188KB

MD5
1af0d9612efc14f9128b542628a18724

SHA1
79069030aab5e9bdf9d8fcfbd71cea5e25a8d282

SHA256
3d255a3ea5583c99264ad00e84c76a954766b3c8eb6a46f5516e04d74417b6f3

SHA512
81ded48dd96851330a10d87c3179402016c08e49778756082ca30d788a7c68c645cda82b276fef68e83c4483841cb143282ce0851b634fd432cdefbc061d077e

Download Submit
C:\Windows\SysWOW64\Dohfbj32.exe

Filesize
188KB

MD5
d7f3ac1be7a2eb724a840cead362b619

SHA1
63c30a7ffab46874654d1c267215432c8b1c9a09

SHA256
3f0ab18cfd63efccfde107be7902a516ebc127685dd18f80d98bb5802f7a5dd5

SHA512
ae2ee403a054276445047b76677600bf35e5e04fc234389c41c812b17e184f2c7b8698cbc848a87d89d4d7558e1edcc1eee64c3eea9b8a1cc7527c73eca986bd

Download Submit
C:\Windows\SysWOW64\Dojcgi32.exe

Filesize
188KB

MD5
5f27c19c3af1241864c8c2dedd13b7cd

SHA1
0d6f6700eaeecc78e030820586e63fa2bce0029c

SHA256
fa052f2c6800a1f968f43c0963c6710acd0a4836fb59175b38f5366d2228cab9

SHA512
a78a0e356e903053c3903fbcebfc3ac750b54517fc838a434c486d0085c3b71ec8339d6e92e5b37f57cc59959c86c19ad0302585974b43cf91248f7743bdd852

Download Submit
C:\Windows\SysWOW64\Eaklidoi.exe

Filesize
188KB

MD5
3f98a880f694990c28551f6f8980c726

SHA1
59a9c0cbf3c83c1fe364f2060d2c55cf595df842

SHA256
bb40c2c22811e8357cb05680acad66ad54a26a229944c8d9809acec8578a9f38

SHA512
108a32a57a1c977fa50d76e35a83dfcba402dcb04d6ab85affa6e2252e7fb1c61a56d9dbbee3e4ed3dda2bdeca080ba1b01ccd184a085cb33b8ac04de370d17c

Download Submit
C:\Windows\SysWOW64\Eamhodmf.exe

Filesize
188KB

MD5
976278191786a5ff2e67d2344f8ed5b8

SHA1
6b77e3cf081f72936130c3839e094dc60fff4d09

SHA256
031a1141cac3269bd5e5f8c7601afabcd1376fb55a01ac872df6a49ef8a1cd82

SHA512
771982fc47fc8c3803e9ded857cb41cadcddf586039bf9778b369c460654db5d25d5f293b301c9a7829e5f11c7e92fdad2ad058a802b2dfb70df62eb619c317a

Download Submit
C:\Windows\SysWOW64\Ecandfpd.exe

Filesize
188KB

MD5
07783f4f6a0ea11bfc1d36e6cdf22f93

SHA1
9969b7164023abcd4f421793e71f2930a221ddbf

SHA256
8e668b13013bc3c572c7ccaee3e2f1541ab9bce6e16481e6a5a7a4ff7158c8b6

SHA512
5efd1316b2727b31c1ed6ce44a5e55723b389b85202c31d6cb7bb951f975a58cc9bcc27cbab9640e201ac46440303389212c098a4ea5260a7760f38b76e9516f

Download Submit
C:\Windows\SysWOW64\Ecmeig32.exe

Filesize
188KB

MD5
a5ec91e5fc450f63fa2037155ae1cd33

SHA1
e0daa0c1b6390ab093494fc6d2c72b68fef86869

SHA256
353f8d7141ef166ca19df4bfb444e4cdb78119e2d7c14df1899f5f353a53b594

SHA512
7e54a3c594fc89274b5873ed445f3437f329787851917320cf96481cb0b87537bdaa4735a6847fc675a0a472c0cb6b6f4d017438626b68e9f9011da1e8aa4aa9

Download Submit
C:\Windows\SysWOW64\Edkdkplj.exe

Filesize
188KB

MD5
93c62bb32f995e44718b918fa040924e

SHA1
6db07255ee191f691ad567528870966b8a237002

SHA256
0c3818a0c46c8edcc868d0290addc0a1bf58f4108829965d07e841d4ef493a59

SHA512
9a73047396689f685492891a4523056a82f43db62d275c2fd573d8e842ced6483f764c769a432eaa86a6e871cf348ebec0267cb31b34af5d91521f95b89ce4a5

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
188KB

MD5
759cc09f4ffd9a4a22a39da319386a01

SHA1
666f1d9967d5c912261b132752dcab3ed8fbdca5

SHA256
b09db97f3be418dbe44f9ee6c5124dbc589e3a976139f89d031282d0c7760c1b

SHA512
6d0d709d57a856f691b1e448dc654f7b972536125ed61df34e3585f097e8692a877b4c8459cfdeb2ff9498f040425b038d22052529779d98a28277cc81df277c

Download Submit
C:\Windows\SysWOW64\Ehnglm32.exe

Filesize
188KB

MD5
1679b3d9b857a1b32e7d1ad463ff2c11

SHA1
454ee7e3ae48fd8e5adb21359db2265435aab913

SHA256
8c2a8433c274eb4184c1c27870c11374b4d41f8588224efbb2d8ef730b79f6fb

SHA512
8adc6570f60a619a88399d387396b8326eb9b966e5ec4000856cd796a2b102ec2b8cce02fe5cf134a375f85207baeafc225cbbc1413a45abda87ddaaf415d136

Download Submit
C:\Windows\SysWOW64\Ekhjmiad.exe

Filesize
188KB

MD5
eb917010a499557c1564c4615608c0ee

SHA1
bc37f71d55cac637d2dfe41d8e3f7e2c0e531f38

SHA256
2868e7f1a2d768d985e04250464049efdfa9d18feee1c579808c3e284607025a

SHA512
dcabec362fc061807a57c267ff0dc67baa814a1b11a0aee69adfde2cf2c7feb626c70c9e80b58359773627609849574c9baff27d56b2d6e580d5eaa9755c90cf

Download Submit
C:\Windows\SysWOW64\Faihkbci.exe

Filesize
188KB

MD5
7513c27b434232b6dede1c058cb05673

SHA1
d743a69fa035792ab5f34ebe65db01dce2d0913b

SHA256
be92672cf6dab31a4f6da18566aa4d5220d39c42221fe4abe028568ce566f8b8

SHA512
53d81ffe306ae5800f260ab13c759fbd6fd7a00dcb4f920bd1ef1a20523e3228ec1f0adc554735ff742087e4b4ae449fb1ce9c00c67bbf4d8b82fcde5b5a7fae

Download Submit
C:\Windows\SysWOW64\Fchddejl.exe

Filesize
188KB

MD5
d6a6e8ea0974dde8235cac155a308ea0

SHA1
c69e624900db413179b6d2f564cc9a1e13dbd511

SHA256
7c94704e62ea35fc86a63c871b8b9b097a292323fcb9800527ec658259ef1805

SHA512
fc8dea2f351960bad27cb910626f94d558851bfc375840cade3d5ca9e945a1f21d3c13fa80f2474f7d7c168d8320ab07b76c6505dc3a2dcc43be9ce893305533

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
188KB

MD5
78e0e59c0b1c349ca20ba3b4f514cbed

SHA1
d03e4c34cf26d66e782b03564594d1445247f894

SHA256
0265da05a4b9669d780659438049638524322710dd0ffeceff161ef931695c31

SHA512
33cfac4db755f8af28f63eb39ae3cdc5b88c7d3175a4adbc6163d2d347499efe455e6780c8a382f5e4e28da3e940f202df3f5e162cac255a0ed96fa5e079ec81

Download Submit
C:\Windows\SysWOW64\Fhabbp32.exe

Filesize
188KB

MD5
a791b42652d6cf73a4a4dcc9b60eca8d

SHA1
e7003f452c7f227ed67af233bc79fd3d18e21853

SHA256
9083f29d080242c8a1ffeecb0e7b99c61134795e728d61663fcddf731dd0be3d

SHA512
ab763d06ac2da6944e0e6af07cd435eea22db99a8fc98c0338596c0fb7e53f6ad10757f6112b5f63426393913a418c02fdb9bfcbc14e3aef15770b53a2b018b5

Download Submit
C:\Windows\SysWOW64\Flnlhk32.exe

Filesize
188KB

MD5
1d89bef13ed3c403796be28c41708b6d

SHA1
2cf9c029f8fcc1e153d4fc92dc0a37adf0b39abf

SHA256
16a6c6cb1abed28e4fca59b45e410207b844528e41252624c60315e2ec0156cd

SHA512
972bed0885224cc823d922941b85156f9f6ed28c52993ec2d7fad25033745f5745b595eb561ae2f5371ed3b9ff8255194f850b9a58d116d004aca8763c2f59cd

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
188KB

MD5
108c58b330df156aa0097743517f496f

SHA1
b2047a7950137142a4cc381ba3c929e8ce17caa1

SHA256
a7335340943c47b1f1d17d9b2530e63bdb75fdc312cda4809210967c5ff7f8ba

SHA512
8af7299bd07342b13fb1529eb997e1f8c694ff5a3f60a4ddbbe73a6563bcd90f14f539d720cc5fc781f3e70083e17a06322b42fdca7808d6f8edec62e7258614

Download Submit
C:\Windows\SysWOW64\Foabofnn.exe

Filesize
188KB

MD5
92a1203edf788a949778325d472e4604

SHA1
fde25aaf1eb1811b6c4a124dde3fc3f2e2cabb3b

SHA256
8b7f65e2cad8b2f378d1b4279f74d00d58dfb9006d10dd0f7d30e9a7b608524a

SHA512
456b860efb2df78ca8fec33a74758cb703c97cbc236134599ffe04d5b3d26743b5840727ea2f40308286e2ef987275a02c8c8ebcf1fd0bfee93ffc95b840bf05

Download Submit
C:\Windows\SysWOW64\Gcfqfc32.exe

Filesize
188KB

MD5
b63386dbe3dda06bc13df3795260ad7e

SHA1
4a9b0c71d8eed18549f641d17264bd20908b1d50

SHA256
19f547d5b6bade4b5ff9ccaa9453c5ded13b4b6199c25a8d60d619eb83cf19a9

SHA512
8debfdb35679d88fbfd753be6df615f1032b6f3dc5bdbcaff29396f56a0e03c47b607e3cbca045810af4ce82e1c59f47bd80d9ae5b9562884f14ec56b4870fc2

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
188KB

MD5
32b97eb9bff02b89fa7c4bdf5c0a1cb9

SHA1
6146743a8917b4390fa37dfc810be9b7037ea1de

SHA256
b9657082bc8af6516533677d4d052b787da9bf0b53c33c665637064018133f01

SHA512
60b6dc8860dbc8745b10eb06992a0cdf7d03f2ef0c6b299dff3072b9a2645b5c382dc66044f174f10997b982ea63e83dceabcf42c0a02d85d4ad9fc7006da511

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
188KB

MD5
182e1d9ae1877e2d4a63fae2c89317d4

SHA1
15934fcfae0ab9f5b7b1479a7ebb62feb99cf0b2

SHA256
a83fea376cddaa9089fa7fc5b1597a79aafea20986d1961f9bccdac37dfd4e18

SHA512
f383414537740faf5a43b3eb5baa8b9cb7c492a3edf0a414b5b443da3e7a57ecc131d86bebf2e1a25e24429190938a08904f083d3184063d714db16186ad8b02

Download Submit
C:\Windows\SysWOW64\Gfgjgo32.exe

Filesize
188KB

MD5
6bd8e885f56d860f902f95fa473032d2

SHA1
bcff417c73151d1a77d093f3ee13a442b68eaeab

SHA256
c3c5ade8884474bf60954b33f01a32eb56349bf7b6897787e9533a996afdcf5a

SHA512
c34d504dd8c45a13efedc81a965c5b8858a734f5fce383484d675f2acda3c8b784d9a4078fa3b005ae099e10de8caa0a2b226280f4f1b5ab5f99d6785c7cd49a

Download Submit
C:\Windows\SysWOW64\Gfpcgpae.exe

Filesize
188KB

MD5
66e156fdddc524a5d7d44292b134d414

SHA1
6219305eab6ef4d56968f41168d610b728cd6204

SHA256
f39a6cb2700bf3e2f826bb4888ae9ff1b83b749a465fd725d9395ffa2a6d7fce

SHA512
235cd0a5b188f679f37832a8d61486f9b50a9efc8bf816b3c0b312f40dc13c64b1470d3b6c1f6634557cf917234b3ab9fbde11d530dbd01b1fd22772f80562db

Download Submit
C:\Windows\SysWOW64\Gkmlofol.exe

Filesize
188KB

MD5
f876ff7bc3e0bfc4dfa7b6785162b5c4

SHA1
c5971155208f60890d7cbcde3a5c9a5d822c05ca

SHA256
a1ba49912fe0af4db01ac8e7f93e08e81029026934d63adc98209a9b6cc74de7

SHA512
b1825be20206822c4e909d8cd04380a4a5cc76f4719cc11135668338cbf5fbebee077dbe3ed240a1f4b4ae6c9e8eb202b4a833a8451546872b18c6981d8c839e

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
188KB

MD5
5ca9e3b11764228bf54e661e8c76ac2d

SHA1
aa3d17e9d58bd369e1848f5ff09f9621f092d554

SHA256
6d83dbeb048c38c2c43346c34883188cab28a54bae582b5ef6a45757d5855d05

SHA512
50c631e9b7c64891cf1329bed9eb6febd356f8a3814167fc780042f121cef79ca9c3c8323e2b54298cb183892bc1e48d3cc96dafb9ceaa0bcdfc0e9072d8c9fd

Download Submit
C:\Windows\SysWOW64\Glhonj32.exe

Filesize
188KB

MD5
4452b328b0e4dd1a78fa2be64c57ac51

SHA1
376c43c1d883294b1b002a6842b25f7eaa07ec4c

SHA256
3b1f6a2fae7aafd506a6ea8cfdf22be7e3bcf870b40b7a2bec56b3c3154d6844

SHA512
8b101e0e687041ba377d9dec1b4c5ac35aa261ff049cce6e63ef94bd57e48e29ac10c32f5bff772b29b9a17507c215a84ffbd97e28556d353a6384a46c764d0c

Download Submit
C:\Windows\SysWOW64\Heapdjlp.exe

Filesize
188KB

MD5
cfca44fea5330765e007752782ed0af4

SHA1
91d319c8301bc97d96cf2807f911146ffec4a62b

SHA256
e859ea56f86d934c6f49abd310b4cadac4327c81f3645e7936bda89177ab93f2

SHA512
7503024c9adf3274450aa49ecad19ef900f958920447f3458678d2a3f8e0953293b80dca55a5b1038c72295bcd99249d99f32754d1d59f761ced546ce1e1bc09

Download Submit
C:\Windows\SysWOW64\Hihbijhn.exe

Filesize
188KB

MD5
98bb3d8220733d7769bbb79dcdebf976

SHA1
9bba7f24e57dd98fbb04ef3981733e69b57dc285

SHA256
c6677b5b3ec86ab08ae74c3fc52fa35840b99c948e27798c110a36175b3dabee

SHA512
ba6fde2834e36851804d433c87c518cb408f6c44ecce02250b1d066c1962f0bd58655c39b1c47907914a6e41fd59ce2d4173e2b956499463111ee6a32d69a4de

Download Submit
C:\Windows\SysWOW64\Hkikkeeo.exe

Filesize
188KB

MD5
10274b4be60842449e15c5cf13aa8721

SHA1
41a48ea0aea3bf28ed5a92d8b73cd2a22ed12420

SHA256
058c48f01212e31c5e48fe43ec762545b13a9f1a468c2644264899a626f3ef9b

SHA512
31ca5c73f474d8cfc70f1b80ed8f2d790a49381eaa6353de917c9205d3d575b1de460231c1b299f0ccb32626c440a8620cdf6875ba6beb9910429e4b7890c1e1

Download Submit
C:\Windows\SysWOW64\Hmjdjgjo.exe

Filesize
188KB

MD5
6221cf67330d219beab05d3b54833e47

SHA1
519194dbff2dbbc91c6657cfe3cf647529630c2d

SHA256
596b27be99498a3bb7ba24ac166ca1e951b7123e1418e46e744804d6662fbf58

SHA512
69e414aa332dad1a24f739cfa82c91d120201f3bbc69f6ff9518467acbc6af6b8fd96f2ab97488799199dbfe59ebcc4a0fa1c2f0fd4104cf991eb7dff7a6ffb0

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
188KB

MD5
38bec3599a365554778d314ef8dc3354

SHA1
26b9988563ecf6002c74000e40c35e092cdb3b41

SHA256
f6a2c5947c5036d42e497715ead76a555495ee3f86bd86abaca4757012afbc1a

SHA512
aea7978b656bfdf076ae1958693d2638f55a21e6e444663c0a919fb09e98a90fdc0897e50bee77028d3518124a73b0bac1b10208a30f04950f601054925d7567

Download Submit
C:\Windows\SysWOW64\Hofdacke.exe

Filesize
188KB

MD5
4531df095bef850293cc550d45fd285a

SHA1
4ced6ec05e5995cd26f4b4f17c19fadffe6a2dde

SHA256
bec4b5fc6d293ad61bf61d69376c69f7dfbb9548641ca75d62c701917882004a

SHA512
86c5383871baee458a53abd4b7f4fddedee0159de99a34d05d59da5b18c7b239c430ef37a79a737a21bbcaeed78bd2104a30ebeac807d10b59fc742d03e1db3d

Download Submit
C:\Windows\SysWOW64\Iefioj32.exe

Filesize
188KB

MD5
757350e447c57c7c8db3863da708cf9a

SHA1
008f348e23d0576066dfce03590c0929240e0692

SHA256
f778cfd3910ce565722ca49d0827f4a1f1ad7e6778215f3faac036df287b31a9

SHA512
58a022411e1ef6ff2a758d409ce2ba80181def7a5d35e7bed24504469947cebbf7e0e8ebb5d52f7f8eb626dac1fc19cacd9a877346ca0290e637fa08aac6691f

Download Submit
C:\Windows\SysWOW64\Ihnkel32.exe

Filesize
188KB

MD5
ffeff11b0a5ffd5fbf42ae3f8b00658d

SHA1
89a7e9c14d4672844871f08d20a315f9661fffeb

SHA256
f9f9c407953799b51903c81929b3a0716965c1bef19ff494280f5b55f0d6df52

SHA512
ffd202e0793bb05b3961c88e81dd6d4f656a85c6d6e23863be230ab2dcab0c5c6f910900c0369edaf67d43a763e9eec18dcc015314da1d997cf9963958f2eccc

Download Submit
C:\Windows\SysWOW64\Jnnpdg32.exe

Filesize
188KB

MD5
c66059a523133598907ab435230f8a09

SHA1
ef39862f62a11b7a21b1edb7491d4f1057e51c2e

SHA256
7d4203dbdff64e2a1e96fd5030a2b7c6fb75dc40acd0b0f8d4bfb989e60b97c5

SHA512
cb4c4e8fd9a0bedbe02bbb67f6e5b246bbe2d126cb5ee397b39ef58a8aec6bd71fdb8d08eda3028d14d5e7e6f3150e44c709482bb725615a1e99403b852f8c0a

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
188KB

MD5
aafdc0a1217191d58eb331dbec198da7

SHA1
b836963083a6f8778eb7f748ff27079f15d7442c

SHA256
c25f1d6bdd3b563ec4a82eb4ae3664b043eb36406a54b91253451fd4418c9190

SHA512
44eb6e0112df61baf0f50b685b41db1e8877c0ee4d6ef524b405c152de1677817f19b319e5f4bda681d169240db7aee4f165a900b3255a1a8f1f50c4f73da6f0

Download Submit
C:\Windows\SysWOW64\Keakgpko.exe

Filesize
188KB

MD5
e2550b6cd6538e607b918b6ee015da3a

SHA1
2ce9904a1a74d059a06e71678a13cbd7bb3eed29

SHA256
ef50739dcfef815130339fd4c2372a20383f3f8cdf7dc7a0bb89ea900c36007a

SHA512
00e4cab43cec06c9438f3abb15285203515d9b76e57c03e8809cd731100c8cf0a01c11ab9c5d16c4d20355d92ec7a1f5d71993a5a127ce13996e3bd53e827b69

Download Submit
C:\Windows\SysWOW64\Lbngllob.exe

Filesize
64KB

MD5
6c80bd36ee2923b6fd86c6a6d2f0cc0a

SHA1
7c7bcc90f089f980f8d2e05dff77870c163ee85b

SHA256
dd44f77d65bf271c8e35fc6ccdef68dea394e739218b5c75573bed86537ed8d9

SHA512
91b2d2c4fac0e702347b08816f62300147ad42df9f7502ec22c957d036d55a80701d2eb5090921e29da81df1a31866dede468270e7d775a5507cbe6bc7426531

Download Submit
C:\Windows\SysWOW64\Lemkcnaa.exe

Filesize
188KB

MD5
f05144fcdc648972a47da35bbd8ba6e5

SHA1
210890480d07483dde348f94d4ae66bda65654ec

SHA256
e9250ca650259baa292569d08dcbdb6a6d6cd7eeed699593405ae178c9a37d15

SHA512
700d65342f4ee67558ef2dd232cec0d044defbf5e09ea2625710b57091520cc10c526ac17229920600f9a7b20a83d83d0db922bc0b2fc31625ee727b0ce533f7

Download Submit
C:\Windows\SysWOW64\Lidmhmnp.exe

Filesize
188KB

MD5
47abb5728248e895811db90911ce2e14

SHA1
361259e8b8cb5b23df5cac51902e56b4bda93128

SHA256
756a364e524b3daac1b862987faf2c93f8d93663c31ec67419620499b7649588

SHA512
c0e3e2d7cd56f85da4bb77b3fa55319f796ca36b66367180f0ae2ab436b968fb03fcaed19c7f2de5ad70d6210ecbaa4280d4ea43f70241c86383e8146d2f328a

Download Submit
C:\Windows\SysWOW64\Mfjcnold.exe

Filesize
64KB

MD5
7ec94a4a2198ef771788a3c7397d7cf3

SHA1
9c2250590e976d5b56c2420dbc79cfd9dabe1618

SHA256
58b6068d0a4004e914fcaf5a482a69fbfbfaf42c061664669a4f51aef859360f

SHA512
212da478f65636a779d100a50ec5fa66ad883fe48f124b7252708fb1db2153e61ce8277f45197e48a4d07d4cb359cea72926ffc1463a7f96bf5190d6c2f28618

Download Submit
C:\Windows\SysWOW64\Nijeec32.exe

Filesize
188KB

MD5
e450136240810c983025d9350be8efa4

SHA1
ab0ae7e3f98885634875b93ded862a7b04d1ea09

SHA256
07067765e28004aeb421d5de8278f5abe5506b9c59a8a097386ab92ea064729d

SHA512
5510f9972fecac09b899118ed03a160ee307f93599f404de667a7a500d4d40186f9700402b116f7d312491e8ff6e0ce52c4d54dece95bc1ae962204ef0cd64fe

Download Submit
C:\Windows\SysWOW64\Ocalcppo.dll

Filesize
7KB

MD5
3537495bb76cefcbd0169872674242f4

SHA1
4f0dc1058c0a63d463edbfcc7161b54b1aad2cc5

SHA256
19160509909aea62b5b16c6c353ccd8c6c66c4d352f955ac16f039f7bcf1806b

SHA512
644cda9872f523343e576ad12097d7fa71608fd546f8f3a133212d1df096757e00085373c270ec6de789adfb7985e8dec3a56d43063c6117d1c1691c4cb48f31

Download Submit
C:\Windows\SysWOW64\Oekiqccc.exe

Filesize
188KB

MD5
51a4a40104ee28d05a3dd225bad179a7

SHA1
426251ebee6290ca34fe35b0f4a6d0de379d1d40

SHA256
59dd5ae3a517ff9c306598cd2e555e6093b5c6b1b1ae8d31812b434d67487f93

SHA512
a2e983618db5600f3b0432db566ec2c7c30a3c1ad3caad0cb44c7a06f23b686f18e8e41743e4fbec88785635064e02247d484eadcd85e6703c5a3047fb80fc67

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
188KB

MD5
de39b8f11c241df0c57a8a67e6c52ba9

SHA1
06e06dd6319ddc0bfa95206ef6a6ea8cc3efd7d9

SHA256
33aed89ab668638e5c32d4b79fc1e53256abf3808941c0c82319c73811be49fd

SHA512
54f12d13082e3635d65c8ba066ddcb209c8502e583df07e1763d19341bcb946e3182063de0e5af05ff1a09767105d225fd87bea40fab5e3382e22d5162212ef3

Download Submit
memory/464-341-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/756-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/836-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/840-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1000-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1072-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1260-359-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1288-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1352-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1460-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1552-407-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1592-431-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1604-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1676-405-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1688-351-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1720-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1728-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1808-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1820-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1844-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1852-443-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-414-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2008-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2052-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2140-365-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2252-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2256-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2304-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2348-381-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2384-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2400-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2456-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2528-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2780-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-323-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2884-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3108-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3464-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3628-135-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3632-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3656-335-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3668-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3696-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3728-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3740-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3772-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3828-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3836-383-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3964-393-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4012-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4068-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4316-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4336-353-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4388-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4428-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4444-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4540-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4600-437-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4664-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4780-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4964-236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5028-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads